2026-05-11 归档

今日共收录 747 条安全情报，包含 109 个 CVE，376 篇安全通告，以及 5 篇研究论文。

← 返回归档列表

漏洞预警2026-05-10 发布INFO

Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files through the image param...

CVE-2022-50944

Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-05-10 发布INFO

Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search paramete...

CVE-2022-50943

Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious s

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-10 发布INFO

OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/password endpoint....

CVE-2021-47953

OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by s

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-05-10 发布INFO

WordPress Picture Gallery 1.4.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Edit Content URL...

CVE-2021-47951

WordPress Picture Gallery 1.4.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-10 发布INFO

Advanced Guestbook 2.4.4 contains a persistent cross-site scripting vulnerability in the smilies administration interface that allows authenticated attackers to inject malicious...

CVE-2021-47950

Advanced Guestbook 2.4.4 contains a persistent cross-site scripting vulnerability in the smilies administration interfac

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-10 发布INFO

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks throu...

CVE-2021-47949

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files an

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-05-10 发布INFO

WordPress GetPaid Plugin 2.4.6 contains an HTML injection vulnerability that allows authenticated attackers to inject arbitrary HTML code by exploiting the Help Text field in pa...

CVE-2021-47948

WordPress GetPaid Plugin 2.4.6 contains an HTML injection vulnerability that allows authenticated attackers to inject ar

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-05-10 发布INFO

Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input in the 'name' ...

CVE-2021-47947

Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject mal

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-10 发布INFO

OpenCart 3.0.36 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenticated attackers to modify victim account details by trick...

CVE-2021-47946

OpenCart 3.0.36 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenti

历史摘要 · 未重新核验 · NVD

#cve #cwe-352

漏洞预警2026-05-10 发布INFO

Argus Surveillance DVR 4.0 contains an unquoted service path vulnerability in the DVRWatchdog service that allows local attackers to escalate privileges by exploiting the servic...

CVE-2021-47945

Argus Surveillance DVR 4.0 contains an unquoted service path vulnerability in the DVRWatchdog service that allows local

历史摘要 · 未重新核验 · NVD

#cve #cwe-428

漏洞预警2026-05-10 发布INFO

memono Notepad 4.2 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character buffers into note fields. Atta...

CVE-2021-47944

memono Notepad 4.2 contains a denial of service vulnerability that allows attackers to crash the application by pasting

历史摘要 · 未重新核验 · NVD

#cve #cwe-789

漏洞预警2026-05-10 发布INFO

TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by uploading malicious PHP files through t...

CVE-2021-47943

TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbi

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-05-10 发布INFO

WordPress Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code...

CVE-2021-47941

WordPress Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows unauthenticated attackers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-10 发布INFO

Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with module creation permissions to execute arbitrary system commands by injec...

CVE-2021-47939

Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with module creation

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-05-10 发布INFO

ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that allows authenticated attackers to execute arbitrary PHP code by in...

CVE-2021-47938

ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that allows au

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-05-10 发布INFO

e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users with theme installation permissions to execute arbitrary commands by uploading mali...

CVE-2021-47937

e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users with theme installation pe

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-05-10 发布INFO

Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary commands by injecting malicious pickle-serialized objects t...

CVE-2021-47935

Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary co

历史摘要 · 未重新核验 · NVD

#cve #cwe-94

漏洞预警2026-05-10 发布INFO

Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters...

CVE-2021-47931

Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject mali

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-05-10 发布INFO

Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handler that allows remote attackers to execute arbitrary SQL q...

CVE-2021-47930

Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handle

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-10 发布INFO

Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by entering payloads in ...

CVE-2021-47929

Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-79